Information Systems Security Policy
|
|
- Dayna Washington
- 8 years ago
- Views:
Transcription
1 Information Systems Security Policy University of South Alabama Computer Services Center University of South Alabama 5840 USA Drive South /19/2014
2 Outline 1 Introduction... 2 Data Retrieval and Dissemination... 3 Procedure... 3 Enforcement of Policy... 3 Data Sources... 4 Student Information... 4 Student Financial Aid Information... 5 Student Housing Information... 5 Payroll Information... 5 Personnel Information... 6 Institutional Research Information... 6 Financial Accounting Information... 6 Classification Standards... 6 Data Classification... 6 Security... 7 Departmental Security... 7 Physical Security... 7 Data Security... 8 Web Servers and Departmental Servers... 8 Electronic Mail System Security... 8
3 Introduction 2 This general security policy has been developed to ensure data integrity and confidentiality for all administrative computer systems at the University of South Alabama. This document will provide guidelines for the classification of data resources, and subsequent retrieval and dissemination of that data by various user groups. These guidelines will allow individual departments to approve data access authorizations for their data (in general cases). Any exceptions to user access situations covered in this general policy will be taken under special consideration by the University Computer Services Center. More and more university employees have access to confidential information via computers. This security policy is not intended to hamper the use of computers in obtaining information necessary to conduct University, college, or departmental business. However, it is intended to encourage responsible use of computers and discretion in dissemination of student and employee information.
4 Data Retrieval and Dissemination 3 Procedure Each set of University data will be classified as having an owner. This owner will be represented by a specific individual within the University department responsible for that data. Any time a department or individual wishes to gain access to another department s data, they must follow the procedure below: 1) If you are requesting access to student information, fill out the appropriate Banner Security access forms that can be found at the following link: and submit it to the Registrar s Office. 2) If you are requesting access to financial information, fill out the appropriate Banner Security access form that can be found at the following link: and submit it to the Business Office. 3) Once your request for data access has been approved by the owner/department responsible, you will be asked to sign a Statement of Accountability form in order to receive a sign-on code and password from the Computer Center. (If you are gaining access to the Student Records system, you will be asked to sign a Statement of Confidentiality/Accountability for the Registrar s Office, as well.) (The following section, Data Sources, provides data descriptions and departmental sources.) Enforcement of Policy Each department is responsible for enforcing this data security policy. University policy states that confidential information is to be used only when necessary for University, college, or departmental business. Refusal to adhere to this policy is a clear violation of the Family Educational Rights and Privacy Act of Offenders will be subject to disciplinary action and possible referral of the violation to the proper authorities.
5 Data Sources For the purposes of this policy, data types are categorized as follows: 4 Student Information Student Financial Aid Information Student Housing Information Administrative Financial Information Personnel Information Institutional Research Information Within these general categories, the different types of data are broken down into subsets; a University source is provided for each. Student Information Data Owner: University Registrar The Office of the Registrar is the official source of information on individual students. For security purposes, student information is divided into the two categories of directory and academic. Directory Information University personnel may have access to directory information and may, without restriction, disseminate information for official use on and off campus. The Family Educational Rights and Privacy Act of 1974 and the University Attorney specify the following as directory information: Student s name, address, telephone number, address, photograph, date and place of birth Major, dates of enrollment, degree conferred and dates of conferral, any graduation distinction Institutions attended prior to admission to the University of South Alabama Participation in officially recognized activities and sports and weight and height of members of University athletic teams Directory information is available on Banner screens such as SPAIDEN, SPAPERS, SGASTDN, SHADEGR and others. If a student does not wish any of the above information released to non-institutional persons or organizations, a Non-Disclosure of Directory Information must be completed in the Registrar s office. Once the student has completed the form, the confidential flag is marked on Banner. A Confidential comment will appear in the upper left hand corner on all Banner screens. This request will remain in effect until the student notifies, in writing, the Registrar s office to remove the flag. Academic Information Academic information, including grades, academic status, class schedules, etc., cannot be released to third parties without the student s written permission. Academic information can be used by University of South Alabama employees having a legitimate educational interest in the student and who are acting within the
6 limitations of their need to know may access student educational records without prior consent of the student. This includes personnel in academic offices as well as student support offices, such as Admissions, Student Accounting, Financial Aid, Registrar, etc.). This is true even if the student has been granted nondisclosure. 5 Academic information not available from Banner should be requested from the Office of the Registrar. Requests for information from students or from agencies or individuals outside the University should also be referred to the Office of the Registrar. Summary Student Information The Office of Institutional Research is the official source of aggregate or summary student information, such as enrollment or credit hour data intended for on- or off- campus dissemination. Requests for reports and analyses involving summary student data to be produced through Banner will be developed in conjunction with the Office of Institutional Research. This will ensure that reports and analyses are based upon the most accurate information and will enhance the consistency and integrity of information generated by colleges and departments. Student Financial Aid Information Data Owner: Director, Financial Aid Office The Financial Aid Office is the official source of information on individual University students receiving financial assistance from various aid programs, including grants and scholarships and loans. All requests for this type of information should be addressed to the Director of Financial Aid. Information on students receiving financial assistance through student loans is maintained by the Financial Aid Office and should be requested from the director of that department. Student Housing Information Data Owner: Director, Department of Housing Any information pertaining to student housing on campus should be requested from the Director of the Department of Housing. Information on students receiving financial assistance through student loans is maintained by the Student Account s Office and should be requested from the director of that department. Payroll Information Data Owner: Director, Payroll Office The Payroll Office is the official source of financial information on individual University employees. All requests for this confidential financial information should be submitted to the Director of Payroll.
7 Personnel Information Data Owner: Director, Human Resources 6 Information concerning specific job positions (classifications, descriptions, etc.) at the University is maintained by the Human Resources department. All requests for employee information (excluding payroll information) should be sent to the Assistant VP, Human Resources. Institutional Research Information Data Owner: Director, Office of Institutional Research Institutional research information includes data on student enrollment, faculty reports, credit hour production, surveys (e.g., retention of students), government reports, etc. The official source for this type of information is the Office of Institutional Research, and all requests for such information should be submitted to the Director of that office. Financial Accounting Information Data Owner: Controller, Business Office Revenue, expenditure and budget information is maintained for each account. information should be submitted to the Controller. Requests for access to Classification Standards Data Classification Data classification indicates what the user is able to do with the data. Specific restrictions are outlined and enforced by individual departments responsible for the data. Specific levels of access clearance include the following: 1. Read only 2. Maintenance (Update, Add, Delete) Various user classifications will have access to data through one or a combination of these clearance levels. Each user ID is restricted by the forms that the user has been granted to access, i.e., their clearance level will provide them the ability to access a limited number of forms. If a user tries to access a form inappropriate to his/her clearance level, a security violation message will appear on the screen. Data should not be downloaded to other storage medium without permission from the departmental owner of that data. Downloading of administrative data requires a separate authorization from the data owner. Individual users will be held responsible for any violation of this procedure.
8 Security 7 Departmental Security Each department will designate an owner for the data it maintains. Appropriate procedure for retrieval and dissemination of University data will be followed as outlined in the previous section, Data Retrieval and Dissemination. Departments storing data subject to University regulations are responsible for ensuring that all such data is protected in accordance with institutional regulations. This applies to all such data from any source, whether electronically transferred from the administrative systems, or entered by the individual department from printed documents. Specifically, departments must ensure that access to individual workstations or servers containing this information or access to output generated from departmental systems, is restricted to individuals authorized to access the data. Password security on individual stations or servers is not sufficient to ensure compliance; any such systems on which regulated data is stored must also be in secure, supervised areas, such as departmental or individual offices. Backup tapes, disks or copies of data on printed or electronic media must be similarly protected. Under no circumstances shall confidential data or access to it be granted to personnel from other departments or non- University personnel without express written authorization from the appropriate administrative office. Any unauthorized storage and/or reproduction of confidential University data (e.g., grades, transcript files, etc.) is strictly prohibited. Physical Security Deans and department/division heads are responsible for ensuring the physical security and responsible use of computers located in departments and offices under their authority. The following policy statements should be made available and/or posted prominently so that all personnel working with computers know the extent of their responsibility. 1) Computers will be located in physically secure areas which can be locked when not in use. 2) Access to computers will be limited to individuals engaged in official University business. 3) Use of computers by student workers should be restricted to those cases in which student workers are absolutely necessary to supplement regular University staff members. Student workers should be thoroughly instructed in the proper and responsible use of computers. (All student workers will be required to sign a Statement of Accountability from the Computer Center before receiving a sign-on code and password.) 4) Each individual with access to administrative information is assigned his/her own user id (username) and password. The owner of the code should not pass on this information to anyone else; the owner is responsible for any misuse of his/her sign-on credentials. 5) Under no circumstances will the aforementioned codes be posted on or near computers 6) Computers which are signed on should never be left unattended.
9 7) Requests for improvement of computer security, as well as suspected violations, should be addressed to the Director, USA Computer Services Center. 8 Computers which are routinely used by individuals not cleared for access to such data are inappropriate locations for confidential data (e.g. computers in student labs or other public locations.) Placing confidential information on systems of this nature constitutes a clear violation of University regulations. Because of the possibility of theft and discovery of data, neither portable computers (notebooks, laptops, etc.) nor portable storage devices, including USB keys and portable disks, should be used to store sensitive or regulated data, unless such data is encrypted. If a computer with communications software is used to access University information systems, no information specific to your access to the system (such as sign-on codes or passwords) shall be encoded in the communications package nor otherwise stored within that computer. This means that the sign-on process cannot be fully automated, but will require keyboard entry of appropriate codes and passwords at sign-on time. If the communications package has been acquired from the Computer Services Center, copies shall not be given to any other individuals or departments. Any such requests should be submitted directly to the Academic Computing Office of the Computer Center. Data Security Any individual who accesses University data, through a computer or a report, is responsible for the confidentiality of that data. Likewise, any individual who stores University data on a personal computer will be held accountable for the confidentiality of that information. Web Servers and Departmental Servers Information subject to University or confidentiality regulation should not be placed on the main University web server without prior written approval from the appropriate administrative offices as well as the Manager of Web Services. Such data should, in general, be placed on Web or other departmental servers only if absolutely essential to University business and only if appropriate safeguards, including appropriate file permissions, access controls and security patch procedures are in place. Electronic Mail System Security Electronic mail poses additional risks in the handling of confidential data. Data may quite readily be transmitted to unintended recipients through misaddressing or similar error. In addition, the routine maintenance of mail systems may require or inadvertently lead to viewing of some pieces of mail by mail systems administrators. The Computer Services Center will respect the privacy of all such mail and will not reveal the contents of such mail to any other parties. However, if activities in violation of law or University regulations are discovered through this procedure, the CSC may report such information to appropriate authorities. Departments are advised that information subject to confidentiality regulations should not be transmitted via electronic mail without prior written approval from the appropriate administrative offices.
How To Protect Data At Northeast Alabama Community College
Information Systems Security Policy Northeast Alabama Community College Center for Information Assurance Northeast Alabama Community College 138 AL Hwy 35, Rainsville, AL 35986 (256) 228-6001 1 5/22/2014
More informationADMINISTRATIVE DATA MANAGEMENT AND ACCESS POLICY
ADMINISTRATIVE DATA MANAGEMENT AND ACCESS POLICY PURPOSE The value of data as an institutional resource is increased through its widespread and appropriate use; its value is diminished through misuse,
More informationPINAL COUNTY POLICY AND PROCEDURE 2.50 ELECTRONIC MAIL AND SCHEDULING SYSTEM
PINAL COUNTY POLICY AND PROCEDURE 2.50 Subject: ELECTRONIC MAIL AND SCHEDULING SYSTEM Date: November 18, 2009 Pages: 1 of 5 Replaces Policy Dated: April 10, 2007 PURPOSE: The purpose of this policy is
More informationIndex .700 FORMS - SAMPLE INCIDENT RESPONSE FORM.995 HISTORY
Information Security Section: General Operations Title: Information Security Number: 56.350 Index POLICY.100 POLICY STATEMENT.110 POLICY RATIONALE.120 AUTHORITY.130 APPROVAL AND EFFECTIVE DATE OF POLICY.140
More informationHamilton College Administrative Information Systems Security Policy and Procedures. Approved by the IT Committee (December 2004)
Hamilton College Administrative Information Systems Security Policy and Procedures Approved by the IT Committee (December 2004) Table of Contents Summary... 3 Overview... 4 Definition of Administrative
More informationINFORMATION TECHNOLOGY DATA MANAGEMENT PROCEDURES AND GOVERNANCE STRUCTURE BALL STATE UNIVERSITY OFFICE OF INFORMATION SECURITY SERVICES
INFORMATION TECHNOLOGY DATA MANAGEMENT PROCEDURES AND GOVERNANCE STRUCTURE BALL STATE UNIVERSITY OFFICE OF INFORMATION SECURITY SERVICES 1. INTRODUCTION If you are responsible for maintaining or using
More informationInformation Security Policy
Information Security Policy Introduction The purpose of the is policy is to protect Rider University information resources from accidental or intentional unauthorized access, modification, or damage and
More informationContact: Henry Torres, (870) 972-3033
Information & Technology Services Management & Security Principles & Procedures Executive Summary Contact: Henry Torres, (870) 972-3033 Background: The Security Task Force began a review of all procedures
More informationCaldwell Community College and Technical Institute
Caldwell Community College and Technical Institute Employee Computer Usage Policies and Procedures I. PURPOSE: The purpose of this section is to define the policies and procedures for using the administrative
More informationResponsible Access and Use of Information Technology Resources and Services Policy
Responsible Access and Use of Information Technology Resources and Services Policy Functional Area: Information Technology Services (IT Services) Applies To: All users and service providers of Armstrong
More informationLANDER UNIVERSITY STUDENT INFORMATION SECURITY AND PRIVACY PROCEDURE
founded in 1872 LANDER UNIVERSITY Office of Information Technology Services LANDER UNIVERSITY STUDENT INFORMATION SECURITY AND PRIVACY PROCEDURE 2012 REVISION TABLE OF CONTENTS I. PRIVACY.....................................................
More informationCentral Texas College District Human Resource Management Operating Policies and Procedures Manual Policy No. 294: Computer Security Policy
Central Texas College District Human Resource Management Operating Policies and Procedures Manual Policy No. 294: Computer Security Policy I. PURPOSE To identify the requirements needed to comply with
More informationVirginia Commonwealth University School of Medicine Information Security Standard
Virginia Commonwealth University School of Medicine Information Security Standard Title: Scope: Data Handling and Storage Standard This standard is applicable to all VCU School of Medicine personnel. Approval
More informationBERKELEY COLLEGE DATA SECURITY POLICY
BERKELEY COLLEGE DATA SECURITY POLICY BERKELEY COLLEGE DATA SECURITY POLICY TABLE OF CONTENTS Chapter Title Page 1 Introduction 1 2 Definitions 2 3 General Roles and Responsibilities 4 4 Sensitive Data
More informationData Management Policies. Sage ERP Online
Sage ERP Online Sage ERP Online Table of Contents 1.0 Server Backup and Restore Policy... 3 1.1 Objectives... 3 1.2 Scope... 3 1.3 Responsibilities... 3 1.4 Policy... 4 1.5 Policy Violation... 5 1.6 Communication...
More informationR345, Information Technology Resource Security 1
R345, Information Technology Resource Security 1 R345-1. Purpose: To provide policy to secure the private sensitive information of faculty, staff, patients, students, and others affiliated with USHE institutions,
More informationInformation Technology Security Policies
Information Technology Security Policies Randolph College 2500 Rivermont Ave. Lynchburg, VA 24503 434-947- 8700 Revised 01/10 Page 1 Introduction Computer information systems and networks are an integral
More informationInformation Security Policy
Information Security Policy Touro College/University ( Touro ) is committed to information security. Information security is defined as protection of data, applications, networks, and computer systems
More informationRowan University Data Governance Policy
Rowan University Data Governance Policy Effective: January 2014 Table of Contents 1. Introduction... 3 2. Regulations, Statutes, and Policies... 4 3. Policy Scope... 4 4. Governance Roles... 6 4.1. Data
More informationCOMPUTER USE POLICY. 1.0 Purpose and Summary
COMPUTER USE POLICY 1.0 Purpose and Summary 1. This document provides guidelines for appropriate use of the wide variety of computing and network resources at Methodist University. It is not an all-inclusive
More informationHIPAA Security Training Manual
HIPAA Security Training Manual The final HIPAA Security Rule for Montrose Memorial Hospital went into effect in February 2005. The Security Rule includes 3 categories of compliance; Administrative Safeguards,
More informationSTUDENT RECORD POLICY, PROCEDURES AND DEFINITIONS
STUDENT RECORD POLICY, PROCEDURES AND DEFINITIONS PURPOSE The purpose of establishing this policy is to ensure Virginia Union University s compliance with the Family Educational Rights and Privacy Act
More informationThe Internet and e-mail 2 Acceptable use 2 Unacceptable use 2 Downloads 3 Copyrights 3 Monitoring 3. Computer Viruses 3
Table of Contents 1 Acceptable use 1 Violations 1 Administration 1 Director and Supervisor Responsibilities 1 MIS Director Responsibilities 1 The Internet and e-mail 2 Acceptable use 2 Unacceptable use
More informationWellesley College Written Information Security Program
Wellesley College Written Information Security Program Introduction and Purpose Wellesley College developed this Written Information Security Program (the Program ) to protect Personal Information, as
More informationINFORMATION TECHNOLOGY Policy 8400 (Regulation 8400) Data Security
INFORMATION TECHNOLOGY Policy 8400 (Regulation 8400) Data Security State Fair Community College shall provide a central administrative system for use in data collection and extraction. Any system user
More informationAcceptable Use of Information Systems Standard. Guidance for all staff
Acceptable Use of Information Systems Standard Guidance for all staff 2 Equipment security and passwords You are responsible for the security of the equipment allocated to, or used by you, and must not
More informationTABLE OF CONTENTS INTRODUCTION... 1 OVERVIEW... 1
TABLE OF CONTENTS INTRODUCTION... 1 OVERVIEW... 1 CRITERIA FOR IDENTIFYING CONFIDENTIAL INFORMATION... 1 Customer Specific Information... 2 Competitively Sensitive Information... 2 CONFIDENTIALITY PROCEDURES...
More informationInformation Security Risk Assessment Checklist. A High-Level Tool to Assist USG Institutions with Risk Analysis
Information Security Risk Assessment Checklist A High-Level Tool to Assist USG Institutions with Risk Analysis Updated Oct 2008 Introduction Information security is an important issue for the University
More informationSierra College ADMINISTRATIVE PROCEDURE No. AP 3721
Sierra College ADMINISTRATIVE PROCEDURE No. AP 3721 Electronic Information Security and Data Backup Procedures Date Adopted: 4/13/2012 Date Revised: Date Reviewed: References: Health Insurance Portability
More informationInformation Security Policy and Handbook Overview. ITSS Information Security June 2015
Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information
More informationInformation Technology Acceptable Use Policy
Information Technology Acceptable Use Policy Overview The information technology resources of Providence College are owned and maintained by Providence College. Use of this technology is a privilege, not
More informationInformation Security and Electronic Communications Acceptable Use Policy (AUP)
Policy No.: AUP v2.0 Effective Date: August 16, 2004 Revision Date: January 17, 2013 Revision No.: 1 Approval jwv / mkb Information Security and Electronic Communications (AUP) 1. INTRODUCTION Southwestern
More informationEthical and Responsible Use of EagleNet 03/26/14 AMW
Campus Technology Services Solutions Center Juniata College 814.641.3619 help@juniata.edu http://services.juniata.edu/cts Ethical and Responsible Use of EagleNet 03/26/14 AMW Preamble The resources of
More informationKentucky Wesleyan College Policy & Procedure Manuals - Student Information Privacy
Kentucky Wesleyan College Policy & Procedure Manual Student Information Privacy Policy Approval: President Policy Type: College Policy Owner: Registrar Responsible Office: Registrar Revision History Approval
More informationStatement of Policy. Reason for Policy
Table of Contents Statement of Policy 2 Reason for Policy 2 HIPAA Liaison 2 Individuals and Entities Affected by Policy 2 Who Should Know Policy 3 Exclusions 3 Website Address for Policy 3 Definitions
More informationAUBnet (email) Accounts Policies
(email) s Policies Reference: CNS-P-Acct Revision: B Supersedes: Purpose: Source: CNS-P-EMAIL-A This policy and related policies provide the framework in which all accounts and email and intranet are provided
More informationHardware and Software
Hardware and Software Purpose Bellevue School District (BSD) provides and requires faculty, staff and students to use data processing equipment and peripherals. BSD maintains multiple computer systems
More informationMarion County School District Computer Acceptable Use Policy
Marion County School District Computer Acceptable Use Policy The Marion County School District (MCSD) offers currently enrolled students, faculty and staff access to the school computer network through
More informationPHI- Protected Health Information
HIPAA Policy 2014 The Health Insurance Portability and Accountability Act is a federal law that protects the privacy and security of patients health information and grants certain rights to patients. Clarkson
More informationPierce County Policy on Computer Use and Information Systems
Pierce County Policy on Computer Use and Information Systems Pierce County provides a variety of information technology resources such as computers, software, printers, scanners, copiers, electronic mail
More informationAPPROVED BY: Signatures on File Chief Information Officer APPROVED BY: Chief Financial Officer PURPOSE
TITLE: COMPUTER USE POLICY PAGE 1 OF 5 EFFECTIVE DATE: 07/2001 REVIEW DATES: 02/2003, 09/2006 REVISION DATES: 03/2005, 03/2008 DISTRIBUTION: All Departments PURPOSE APPROVED BY: Signatures on File Chief
More informationHealth Insurance Portability and Accountability Act (HIPAA) Overview
Health Insurance Portability and Accountability Act (HIPAA) Overview Agency, Contract and Temporary Staff Orientation Initiated: 5/04, Reviewed: 7/10, Revised: 10/10 Prepared by SHS Administration & Samaritan
More informationCORPORATE. Tab Authority Subject Related Policies POLICY STATEMENT PURPOSE
POLICY AND PAGE 1 of 7 OCTOBER 25, 2007 Tab Authority Subject Related Policies Corporate Services Information Technology Services Responsible Computing Corporate IT Guiding Principles Policy, Harassment
More informationCOLLINS CONSULTING, Inc.
COLLINS CONSULTING, Inc. TECHNOLOGY PLATFORM USE POLICY 53-R1 COLLINS CONSULTING, INC. TECHNOLOGY PLATFORM USE POLICY Confidential Collins Consulting, Inc. maintains, as part of its technology platform,
More informationa) Access any information composed, created, received, downloaded, retrieved, stored, or sent using department computers.
CAYUGA COUNTY POLICY MANUAL Section 11 Subject: Electronic messaging and internet 1 Effective Date: 5/25/10; Res. 255-10 Supersedes Policy of: November 28, 2000 Name of Policy: County Computer Hardware-Software
More informationLAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL. for INFORMATION RESOURCES
LAMAR STATE COLLEGE - ORANGE INFORMATION RESOURCES SECURITY MANUAL for INFORMATION RESOURCES Updated: June 2007 Information Resources Security Manual 1. Purpose of Security Manual 2. Audience 3. Acceptable
More informationDATA AND USER ACCESS POLICIES
Contents UNIVERSITY OF CHICAGO ALUMNI & DEVELOPMENT DATABASE (GRIFFIN) DATA AND USER ACCESS POLICIES Approved by the Griffin Steering Committee 2/1/07 What is Griffin? Griffin Policies & Procedures Your
More informationInformation Security Policy
Information Security Policy Policy Contents I. POLICY STATEMENT II. REASON FOR POLICY III. SCOPE IV. AUDIENCE V. POLICY TEXT VI. PROCEDURES VII. RELATED INFORMATION VIII. DEFINITIONS IX. FREQUENTLY ASKED
More informationInformation Security Policy September 2009 Newman University IT Services. Information Security Policy
Contents 1. Statement 1.1 Introduction 1.2 Objectives 1.3 Scope and Policy Structure 1.4 Risk Assessment and Management 1.5 Responsibilities for Information Security 2. Compliance 3. HR Security 3.1 Terms
More informationPII Personally Identifiable Information Training and Fraud Prevention
PII Personally Identifiable Information Training and Fraud Prevention Topics What is Personally Identifiable Information (PII)? Why are we committed to protecting PII? What laws govern us? How do we comply?
More informationCaldwell Community College and Technical Institute
Caldwell Community College and Technical Institute Student Computer Usage Policies and Procedures I. Campus Computer Usage Overview: The purpose of this document is to define the policies and procedures
More informationAPPROPRIATE USE OF INFORMATION TECHNOLOGY SYSTEMS INFRASTRUCTURE RESOURCES
APPROPRIATE USE OF INFORMATION TECHNOLOGY SYSTEMS (INCLUDING INTERNET & E-MAIL) EMC CORPORATE POLICY COPYRIGHT 2007 EMC CORPORATION. ALL RIGHTS RESERVED. NO PORTION OF THIS MATERIAL MAY BE REPRODUCED,
More informationJasper City Schools. Data Governance
Jasper City Schools Data Governance The following documents are affiliated with Jasper City Schools Data Governance policy, procedures, training, and guidance. Contents State Monitoring Checklist Cross-Reference...
More informationState of Illinois Department of Central Management Services GENERAL SECURITY FOR STATEWIDE IT RESOURCES POLICY
State of Illinois Department of Central Management Services GENERAL SECURITY FOR STATEWIDE IT RESOURCES POLICY Effective December 15, 2008 State of Illinois Department of Central Management Services Bureau
More informationPOLICIES. Campus Data Security Policy. Issued: September, 2009 Responsible Official: Director of IT Responsible Office: IT Central.
POLICIES Campus Data Security Policy Issued: September, 2009 Responsible Official: Director of IT Responsible Office: IT Central Policy Statement Policy In the course of its operations, Minot State University
More informationCovered Areas: Those EVMS departments that have activities with Covered Accounts.
I. POLICY Eastern Virginia Medical School (EVMS) establishes the following identity theft program ( Program ) to detect, identify, and mitigate identity theft in its Covered Accounts in accordance with
More informationPrivacy and Security Protecting Personal Information Kim Hart and Bill Trott
Privacy and Security Protecting Personal Information Kim Hart and Bill Trott Privacy Video http://www.youtube.com/watch?feature=pla yer_embedded&v=rnjl9eecsoe What is today about? Understand key principles
More informationValdosta Technical College. Information Security Plan
Valdosta Technical College Information Security 4.4.2 VTC Information Security Description: The Gramm-Leach-Bliley Act requires financial institutions as defined by the Federal Trade Commision to protect
More informationAuthorized. User Agreement
Authorized User Agreement CareAccord Health Information Exchange (HIE) Table of Contents Authorized User Agreement... 3 CareAccord Health Information Exchange (HIE) Polices and Procedures... 5 SECTION
More informationLINCOLN UNIVERSITY. Approved by President and Active. 1. Purpose of Policy
LINCOLN UNIVERSITY Policy: Computer and Network Usage by Employees Policy Number: HRM-110 Effective Date: July 1, 2009 Revisions: Replaces, as they relate specifically to employees, IT Policies 517 Internet
More informationVirginia Commonwealth University Information Security Standard
Virginia Commonwealth University Information Security Standard Title: Scope: Data Classification Standard This document provides the classification requirements for all data generated, processed, stored,
More informationDEPARTMENT OF MENTAL HEALTH POLICY/PROCEDURE
2 of 10 2.5 Failure to comply with this policy, in whole or in part, if grounds for disciplinary actions, up to and including discharge. ADMINISTRATIVE CONTROL 3.1 The CIO Bureau s Information Technology
More informationAcceptable Use Policy
Acceptable Use Policy I. Introduction Each employee, student or non-student user of Greenville County Schools (GCS) information system is expected to be familiar with and follow the expectations and requirements
More informationOklahoma State University Policy and Procedures. Red Flags Rules and Identity Theft Prevention
Oklahoma State University Policy and Procedures Rules and Identity Theft Prevention 3-0540 ADMINISTRATION & FINANCE July 2009 Introduction 1.01 Oklahoma State University developed this Identity Theft Prevention
More informationUniversity of Maryland Baltimore Information Technology Acceptable Use Policy
The UMB School of Nursing follows and adheres to the UMB Campus Information Technology Acceptable Use Policy. The UMSON further defines Authorized User to also include any person who receives a password
More informationWho Should Know This Policy 2 Definitions 2 Contacts 3 Procedures 3 Forms 5 Related Documents 5 Revision History 5 FAQs 5
Information Security Policy Type: Administrative Responsible Office: Office of Technology Services Initial Policy Approved: 09/30/2009 Current Revision Approved: 08/10/2015 Policy Statement and Purpose
More informationAll Users of DCRI Computing Equipment and Network Resources
July 21, 2015 MEMORANDUM To: From Subject: All Users of DCRI Computing Equipment and Network Resources Eric Peterson, MD, MPH, Director, DCRI Secure System Usage The purpose of this memorandum is to inform
More informationInformation Security Operational Procedures
College Of Coastal Georgia Information Security Operational Procedures Banner Student Information System Security Policy INTRODUCTION This document provides a general framework of the policy utilized by
More informationU.S. Department of the Interior's Federal Information Systems Security Awareness Online Course
U.S. Department of the Interior's Federal Information Systems Security Awareness Online Course Rules of Behavior Before you print your certificate of completion, please read the following Rules of Behavior
More informationROCHESTER AREA SCHOOL DISTRICT
No. 815.4 SECTION: OPERATIONS ROCHESTER AREA SCHOOL DISTRICT TITLE: E-MAIL SECURITY ADOPTED: October 22, 2001 REVISED: August 11, 2008 815.4. E-MAIL SECURITY 1. Purpose This policy statement provides specific
More informationHIPAA and Health Information Privacy and Security
HIPAA and Health Information Privacy and Security Revised 7/2014 What Is HIPAA? H Health I Insurance P Portability & A Accountability A - Act HIPAA Privacy and Security Rules were passed to protect patient
More informationInformation Technology Acceptable Use Policies and Procedures
Information Technology Acceptable Use Policies and Procedures The following Information Technology Acceptable Use Policies and Procedures are to be followed by ALL employees, contractors, vendors, and
More informationNetwork and Workstation Acceptable Use Policy
CONTENT: Introduction Purpose Policy / Procedure References INTRODUCTION Information Technology services including, staff, workstations, peripherals and network infrastructures are an integral part of
More informationAppropriate Use of Campus Computing and Network Resources
The Claremont Colleges Policy Regarding Appropriate Use of Campus Computing and Network Resources Approved by the Council of The Claremont Colleges on 08/20/04 An overall guiding mission of The Claremont
More informationResponsible Use of Technology and Information Resources
Responsible Use of Technology and Information Resources Introduction: The policies and guidelines outlined in this document apply to the entire Wagner College community: students, faculty, staff, alumni
More informationSUNY College at Oneonta Information Technology Acceptable Use Policy
Policy Statement The College s Information Technology resources are intended for the exclusive use of people having a relationship with the College who have been assigned a valid user account. College
More informationInformation Security Operational Procedures Banner Student Information System Security Policy
Policy No: 803 Area: Information Technology Services Adopted: 8/6/2012 Information Security Operational Procedures Banner Student Information System Security Policy INTRODUCTION This document provides
More informationDEALERSHIP IDENTITY THEFT RED FLAGS AND NOTICES OF ADDRESS DISCREPANCY POLICY
DEALERSHIP IDENTITY THEFT RED FLAGS AND NOTICES OF ADDRESS DISCREPANCY POLICY This Plan we adopted by member, partner, etc.) on Our Program Coordinator (date). (Board of Directors, owner, We have appointed
More informationUnited States Citizenship and Immigration Services (USCIS) Enterprise Service Bus (ESB)
for the United States Citizenship and Immigration Services (USCIS) June 22, 2007 Contact Point Harry Hopkins Office of Information Technology (OIT) (202) 272-8953 Reviewing Official Hugo Teufel III Chief
More informationAppendix H: End User Rules of Behavior
Appendix H: End User Rules of Behavior 1. Introduction The Office of Management and Budget (OMB) has established the requirement for formally documented Rules of Behavior as set forth in OMB Circular A-130.
More informationFARMINGTON PUBLIC SCHOOLS 2410
FARMINGTON PUBLIC SCHOOLS 2410 Administration Retention of Electronic Records and Information I. POLICY The Board of Education (the Board ) complies with all state and federal regulations regarding the
More information8.03 Health Insurance Portability and Accountability Act (HIPAA)
Human Resource/Miscellaneous Page 1 of 5 8.03 Health Insurance Portability and Accountability Act (HIPAA) Policy: It is the policy of Licking/Knox Goodwill Industries, Inc., to maintain the privacy of
More informationPrivacy Data Loss. Privacy Data Loss. Identity Theft. The Legal Issues
Doing Business in Oregon Under the Oregon Consumer Identity Theft Protection Act and Related Privacy Risks Privacy Data Loss www.breachblog.com Presented by: Mike Porter March 10, 2009 2 Privacy Data Loss
More informationApproved By: Agency Name Management
Policy Title: Effective Date: Revision Date: Approval(s): LASO: CSO: Agency Head: Media Protection Policy Every 2 years or as needed Purpose: The intent of the Media Protection Policy is to ensure the
More informationASCINSURE SPECIALTY RISK PRIVACY/SECURITY PLAN July 15, 2010
ASCINSURE SPECIALTY RISK PRIVACY/SECURITY PLAN July 15, 2010 OBJECTIVE This Security Plan (the Plan ) is intended to create effective administrative, technical and physical safeguards for the protection
More informationFerris State University
Ferris State University BUSINESS POLICY TO: All Members of the University Community 2009:08 DATE: May 2009 I. BACKGROUND IDENTITY THEFT PREVENTION PROGRAM The risk to the University, and its students,
More informationHIPAA Audit Risk Assessment - Risk Factors
I II Compliance Compliance I Compliance II SECTION ONE COVERED ENTITY RESPONSIBILITIES AREA ONE Notice of Privacy Practices 1 Is your full notice of privacy practices given to every new patient in your
More informationInformation Security Policy
Information Security Policy Policy Title Responsible Executive Responsible Office Information Security Policy Vice President for Information Technology and CIO, Jay Dominick Office of Information Technology,
More informationIdentity Theft and Data Protection
Identity Theft and Data Protection As keepers of student, faculty, and staff information, we as an institution are obligated and regulated by state and federal laws to protect certain pieces of information.
More informationCollege of DuPage Information Technology. Information Security Plan
College of DuPage Information Technology Information Security Plan April, 2015 TABLE OF CONTENTS Purpose... 3 Information Security Plan (ISP) Coordinator(s)... 4 Identify and assess risks to covered data
More informationBates Technical College. Information Technology Acceptable Use Policy
Bates Technical College Information Technology Acceptable Use Policy Consistent with policy adopted by the Board of Trustees, Bates Technical College, hereinafter referred to as the College, has a commitment
More informationSt. John Fisher College Banner/ApplicationXtender Access Request Form
St. John Fisher College Banner/ApplicationXtender Access Request Form The Banner/ApplicationXtender Access Request Form consists of five pages, this instruction page and four pages for access request of
More informationHow To Use A College Computer System Safely
Claremont Graduate University and The Claremont Colleges Policy Regarding Appropriate Use of Campus Computing and Network Resources An overall guiding mission of The Claremont Colleges is education in
More informationIDENTITY THEFT PREVENTION (Red Flag) POLICY
IDENTITY THEFT PREVENTION (Red Flag) POLICY The risk to the College, its employees and students from data loss and identity theft is of significant concern to the College and can be reduced only through
More informationAn Introduction on How to Better Protect Your Computer and Sensitive Data
An Introduction on How to Better Protect Your Computer and Sensitive Data Common Security Problems Computer users who fail to use strong passwords Constant attacks by viruses, worms, key loggers and bots
More informationBy the end of this course you will demonstrate:
1 By the end of this course you will demonstrate: 1. that HIPAA privacy rules protect privacy and security of confidential information. 2. your responsibility for use and protection of protected health
More informationAPPROVED BY: DATE: NUMBER: PAGE: 1 of 9
1 of 9 PURPOSE: To define standards for appropriate and secure use of MCG Health electronic systems, specifically e-mail systems, Internet access, phones (static or mobile; including voice mail) wireless
More informationTEMPLE UNIVERSITY POLICIES AND PROCEDURES MANUAL
TEMPLE UNIVERSITY POLICIES AND PROCEDURES MANUAL Title: Policy Number: 04.75.12 Issuing Authority: Office of the Vice President for Computer and Financial Services, and Chief Information Officer Responsible
More informationRed Flags Rule. ECU Training Presentation. Provided by the Office of Enterprise Risk Management Updated 5/13/2013
Red Flags Rule ECU Training Presentation Provided by the Office of Enterprise Risk Management Updated 5/13/2013 What is the Red Flags Rule? Requires implementation of a written Identity Theft Prevention
More information